| 제목 | zhayujie CowAgent 2.1.6 Denial of Service |
|---|
| 설명 | CowAgent has a medium-high impact denial of service vulnerability in multiple channel media download handlers.
Feishu, DingTalk, QQ, Slack, and WeCom media paths download attacker-controlled image, file, audio, or video content without a unified byte limit. Several paths read response.content directly, buffering the full HTTP response in memory before writing it to disk. Slack streams chunks but does not enforce a cumulative byte cap. Some Feishu downloads also omit request timeouts.
An attacker who can send media to a configured bot can force CowAgent to consume excessive memory, disk space, channel worker time, and downstream vision/STT/model budget, degrading responsiveness or making the service unavailable.
Verified on commit 61206ba73479db054921594a57b7df1c82694d29 / desktop version 2.1.6 with a safe local PoC. |
|---|
| 원천 | ⚠️ https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Report |
|---|
| 사용자 | pengguogood (UID 72903) |
|---|
| 제출 | 2026. 09. 03. AM 11:41 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 10. PM 11:22 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416391 [zhayujie CowAgent 까지 2.1.9 Media Download 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|